Connections
Many workflow blocks reach out to another service — Slack, Gmail, Google Sheets, Notion, an AI provider, and so on. Before a block can do that, it needs permission to sign in on your behalf.
A connection is that stored permission. You set it up once in the Connections hub, then pick it from a dropdown inside any block that needs it. Secrets are encrypted at rest and only unlocked while a workflow is running — they are never shown back to you, not even to the person who added them.
The two kinds of connection
| Kind | How you set it up | Shows up under | Typical services |
|---|---|---|---|
| Connected account | You sign in to the service through a popup and approve access | Connected accounts | Google, Microsoft |
| API credential | You paste a key or token the service gave you | API credentials | OpenAI, Slack, Notion, Stripe, Tavily |
Both work the same way once saved: a block just picks the connection by name.
:::info Arketic's own steps need no connection Blocks that stay inside Arketic — knowledge base search, document search, Arketic web search, the Arketic assistant, speech and image blocks, task create/update, in-app notifications, and the built-in Arketic AI model — work out of the box with nothing to connect. You only need a connection when a block leaves Arketic. :::
Opening the Connections hub
Go to Workflows → Connections.
The hub has four parts, top to bottom:
- A one-line reminder that secrets are encrypted and resolved only at run time.
- Two buttons on the right — Connect account and Add connection.
- A health summary strip that answers "is anything broken?" at a glance.
- Two shelves — Connected accounts and API credentials — each holding one card per connection.
If you haven't set anything up yet you'll see No connections yet, with the message "Connect an account or add an API key so your workflow blocks can reach the services they automate." and both buttons right there.
Each shelf has its own empty hint too:
| Shelf | Hint when it's empty |
|---|---|
| Connected accounts | No connected accounts. Use "Connect account" for OAuth services like Google. |
| API credentials | No API keys yet. Add one for services that authenticate with a key or token. |
Connecting an account (sign-in)
Use this for services where you sign in rather than paste a key.
- Click Connect account.
- Pick the provider from the menu.
- A popup opens on the provider's own sign-in page. Sign in and approve the access it asks for.
- The popup closes and you'll see Account connected. The new account appears on the Connected accounts shelf.
Providers you can sign in with
| Provider | Status |
|---|---|
| Available | |
| Microsoft | Available |
| Atlassian | Available. No block in the palette uses an Atlassian account yet |
| Slack | Soon badge — not selectable yet |
| GitHub | Soon badge — not selectable yet |
Providers marked Soon are shown greyed out with a Coming soon tooltip rather than a button that would fail. Slack and GitHub blocks work today with a key instead — add it with Add connection.
A connected Google account serves all the Google blocks that sign in — Gmail, Google Sheets, Google Drive, Google Calendar and the rest — and a connected Microsoft account serves Outlook, Microsoft Teams, Microsoft Excel, OneDrive, SharePoint and Microsoft Planner.
:::caution If the popup doesn't open Your browser may be blocking it — you'll see Popup blocked — allow popups and try again. Allow popups for Arketic and click the provider again. If the sign-in ends without access being granted, Arketic reports Connection was cancelled. and nothing is saved. Closing the popup yourself simply ends the attempt. :::
If your organisation hasn't finished setting up a particular sign-in provider yet, Arketic tells you plainly instead of failing silently. Ask your administrator to complete the setup, then try again.
Adding an API credential (key or token)
Use this for services that hand you a key or token to paste.
- Click Add connection. The Add a connection gallery opens with the search box already focused.
- Type to narrow it down — the placeholder suggests Search connections… (e.g. Slack, Notion, OpenAI). Search matches the service name.
- Click the service's card.
Each card carries a small label telling you what to expect:
| Card label | What it means |
|---|---|
| Key · testable | Paste a key — Arketic can check it automatically |
| Key | Paste a key — this service offers no automatic check |
:::info Why some services aren't in the gallery The gallery lists the services your workflow blocks can actually use. If you search for something and see No provider matches “…”., there is no block for it yet. :::
The New Credential dialog
Picking a service opens New Credential:
| Field | Notes |
|---|---|
| Provider | A dropdown of services. It is shown only when you open the dialog from a block that isn't tied to one service — an Agent or API block, for example. From the gallery, and from a block that knows its service, the service is already chosen and the field is hidden |
| Name | Required. Your own label for this connection — e.g. My OpenAI key. Up to 200 characters |
| Secret field(s) | One or more fields defined by that service — for example a key, a token, or a key plus an account identifier. Secrets are typed into masked fields |
Under the fields, some services add a short note about the key. Click Create (it shows Creating… while it works) or Cancel to back out.
What happens right after Create
- For a testable service, Arketic runs one live check immediately and reports Credential verified — {service}. If the check doesn't come back clean, the connection is still saved and the message — Saved, but test was … — tells you the outcome so you can fix it.
- For a service with no automatic check, you simply get Credential created.
Missing fields are flagged inline before anything is saved (for example Name is required).
:::tip Name connections for the job, not just the service You can store more than one credential per service. Marketing HubSpot and Support HubSpot are far easier to pick correctly inside a block than two entries both called HubSpot. :::
Health: knowing what still works
Every connection carries a health chip so you can see at a glance whether a workflow that depends on it will run.
| Chip | What it means | What to do |
|---|---|---|
| Connected | Working | Nothing |
| Invalid | The service rejected the key or token | Re-enter the key, or reconnect the account |
| Action needed | The stored credential has expired | Reconnect to refresh it |
| Not tested | Saved but never checked yet | Run Test now when convenient |
| Can't auto-verify | This service offers no automatic check | Confirm it works by running the workflow |
When something is wrong, the card and the details drawer show a plain-language reason instead of a raw error, such as:
- Key rejected (401) — re-enter it
- Access denied (403) — check the key's permissions
- Key format looks wrong — check for stray spaces
- Expired — reconnect to refresh
- Provider error (503) — try testing again
- Authentication failed — re-enter the key
:::info Health is read, not re-tested Opening the Connections tab never fires off live checks against every service. The chips reflect what Arketic already knows. To re-check something on purpose, use Test now on that connection. :::
The health summary strip
Above the shelves, a single line tells you where you stand. When everything is fine it simply reads All … connections healthy. Otherwise it breaks the total down into how many are healthy, how many are not tested, and how many need attention — that last figure is a clickable link.
- Click … need(s) attention → to filter both shelves down to only the broken connections.
- While the filter is on, a Showing needs attention chip appears — click it to go back to everything.
Connections that need attention also sort to the top of their shelf by default, so you never have to hunt for them.
Reading a connection card
Each card on a shelf shows:
- The name you gave it, with the service and the connection type underneath (API key, OAuth account, Bearer token, or Basic auth).
- Its health chip, plus the first couple of access scopes for a signed-in account.
- A last line that depends on the state: Tested just now, Tested 5m ago, Tested 2h ago, Tested 3d ago or Never tested for a key, and Connected for an account.
- If something is wrong, the reason and a one-click Reconnect (account) or Re-enter (key) button right on the card.
Hovering an API credential card also reveals a small Test connection button so you can re-check it without opening anything.
Click anywhere else on the card to open its details.
When a shelf gets busy
Once a shelf holds more than eight connections, a toolbar appears above it with:
| Control | What it does |
|---|---|
| Search box | Filters that shelf by connection name or service. Its placeholder reads Search connected accounts… or Search API credentials… |
| All / Needs attention | Same triage filter as the summary strip |
| Sort dropdown | Health (problems first, the default), Recently added, or Name A→Z |
If a filter leaves nothing behind you'll see No connections match your filter.
The connection details drawer
Click a connection to slide out its details panel. Press Esc, click the backdrop, or use the × to close it.
Health
The health chip, the plain-language reason if there is one, and the action that fixes it:
| Connection type | Button | Effect |
|---|---|---|
| API credential | Test now | Runs one live check and reports the result |
| API credential that needs attention | Re-enter key | Reopens the secret fields so you can paste a fresh key |
| Connected account | Reconnect | Reopens the provider sign-in popup |
Underneath sits Last checked: with the date and time of the most recent check.
Test results are reported straight away:
| Outcome | Message |
|---|---|
| Works | Credential is valid. |
| Rejected | Provider rejected the credential. |
| Couldn't tell | Could not verify right now — try again later. |
| No check available | This provider has no test endpoint. |
Identity
A short read-only summary: Provider, Type, Expires or Token expires (when the service sets one), the date it was Added, and — for signed-in accounts — the Scopes you approved. A footer note repeats the rule: Encrypted at rest, decrypted only at run time. The secret is never shown.
Danger zone
| Button | Confirmation | Result |
|---|---|---|
| Delete credential (API credential) | Delete credential? — warns that blocks referencing it stop authenticating until you pick another. Confirm with Delete | Credential deleted |
| Disconnect account (connected account) | Disconnect account? — warns that blocks using it stop authenticating until you reconnect. Confirm with Disconnect | Account disconnected |
:::caution Removing a connection is immediate Any workflow whose blocks point at it will fail to authenticate from the next run onward. Repoint those blocks at another connection first if the workflow needs to keep running. :::
Using a connection in a block
Blocks that reach an external service have a credential field. Its label depends on the block: Authentication on integration blocks and the API block, Credential on most AI blocks, Provider credential on the Agent, Router and Evaluator, and a specific name on triggers — Bot token, Google Account, Mailbox account and so on.
- Open the block's settings (double-click the block, or use Open details in its hover tray).
- Open the credential dropdown. It lists the saved connections you can use for that service by name — the empty prompt reads Select a credential…, or No credentials configured when you have none yet.
- Pick one, and close the block.
Two shortcuts save you a trip:
- For key-based services, an Add credential link sits under the dropdown. It opens the same New Credential dialog and selects the new connection for you as soon as it's created. This is also how you add the two secrets that have no gallery card: the Slack Signing Secret on a Slack Trigger and the Meta App Secret on a WhatsApp Trigger.
- For sign-in-based services, the field instead reminds you: Connect an account under Workflows → Connections. — set the account up there first, then come back and pick it.
:::tip Model blocks are the common exception In the Agent, Router and Evaluator blocks the Model dropdown starts on Arketic AI, which needs no connection at all. To use an external AI provider's model, pick that provider's connection in Provider credential first — its models then appear in the Model list. :::
When a run stops and asks for a credential
If a workflow starts running and then can't authenticate, the run pauses instead of failing outright. An amber banner in the editor reads Credential required — {service}, followed by the reason.
| Connection | What the banner offers | What to do |
|---|---|---|
| A key or token | Update key | Click it, re-enter the key in the Update Credential dialog and click Update. The run resumes on its own and picks up where it left off |
| A key the run can't identify (for example, one that was deleted) | Re-select a credential on “block”, then run again. — the block name is a link | Open the block, pick a connection, and run the workflow again |
| A connected account | A note that reconnecting isn't available from the banner | Go to Workflows → Connections, open the account and use Reconnect, then run the workflow again |
See Running Workflows for the full run controls.
What you can connect
A service can be connected when it has a block. These are the services you'll find, grouped by what people usually use them for.
By signing in (Connect account):
| Account | Blocks it serves |
|---|---|
| Gmail, Gmail Trigger, Google Sheets, Google Calendar, Google Drive, Google Docs, Google Tasks, Google Contacts, Google Forms, Google Slides, Google Groups, Google Meet, Google Vault, Google Ads, Google BigQuery | |
| Microsoft | Outlook, Outlook Trigger, Microsoft Teams, Microsoft Excel, Microsoft Planner, OneDrive, SharePoint |
With a key or token (Add connection) — the names are the ones on the gallery cards:
| Group | Services |
|---|---|
| Messaging & email | Slack, Telegram Bot, WhatsApp Cloud API, IMAP Mailbox, SMTP Server, Resend, SendGrid, Loops.so, Mailgun, Mailchimp |
| Google services that use a key | Google API Key — for Google Maps, Google Translate, Google Books, Google PageSpeed and YouTube |
| Notes & knowledge | Notion, Obsidian |
| Development & operations | GitHub, GitLab, Sentry, Linear, Asana, Vercel, Cloudflare, PagerDuty, incident.io, Rootly, LaunchDarkly, LangSmith, Tinybird |
| CRM, sales & recruiting | HubSpot, Pipedrive, Attio, Intercom, Apollo, Hunter, LinkedIn, Greenhouse, Ashby, Rippling, DinamikCRM |
| Payments & commerce | Stripe, Shopify, RevenueCat |
| AI providers | OpenAI, Anthropic, Cohere, Mistral AI, Perplexity, Hugging Face, ElevenLabs, Replicate |
| Web search & research | Tavily, Exa.ai, Jina AI, Firecrawl, Serper.dev, Linkup, Apify, Airweave, Brandfetch, Similarweb, Pulse |
| Meetings & scheduling | Calendly, Fathom, Granola, Grain |
Search the gallery for the service you have in mind. If it doesn't show up, it isn't available as a workflow block yet; let your administrator know.
Sharing a connection with your team
An API credential can be shared with specific teammates so more than one person can build workflows using it, without each person needing their own key. Open the connection's details and add the people who should be able to use it. Anyone you remove immediately loses the ability to run blocks that depend on that credential.
Good practice
- Give keys the least access they need. Create the key in the other service with only the permissions your workflow uses. If something is later rejected with Access denied (403), that key's permissions are the first place to look.
- Name connections clearly. The block dropdown shows only the name, so the name has to be enough to choose correctly.
- Deal with Action needed before it bites. A scheduled workflow that runs overnight won't ask you to reconnect — it will just fail.
- Test after you rotate a key. When you replace a key in the other service, use Re-enter key here and then Test now, rather than waiting for the next run to find out.
- Prefer Arketic-native blocks where they fit. Knowledge search, task actions and notifications need no keys to maintain at all.
Related pages
- Creating Workflows — build the workflow the connection will serve
- Blocks — which blocks need a connection and what each one does
- Running Workflows — running, pausing and resuming a run
- Logs — step-by-step detail when a run fails
- Workflows Overview — the Workflows tabs at a glance